# Vulnerabilities published in 2026 - [MAL-2026-3160](https://insights.sbomify.com/MAL-2026-3160/): Malicious code in apple-internal-pki-utils (npm) (malicious package) - [MAL-2026-316](https://insights.sbomify.com/MAL-2026-316/): Malicious code in tailwind-merge-v3 (npm) (malicious package) - [MAL-2026-3159](https://insights.sbomify.com/MAL-2026-3159/): Malicious code in apple-internal-pki-trust-v5 (npm) (malicious package) - [MAL-2026-3158](https://insights.sbomify.com/MAL-2026-3158/): Malicious code in apple-internal-pki-trust (npm) (malicious package) - [MAL-2026-3157](https://insights.sbomify.com/MAL-2026-3157/): Malicious code in apple-internal-auth-v3 (npm) (malicious package) - [MAL-2026-3156](https://insights.sbomify.com/MAL-2026-3156/): Malicious code in apple-infra-ultimate-bypass (npm) (malicious package) - [MAL-2026-3155](https://insights.sbomify.com/MAL-2026-3155/): Malicious code in apple-infra-network-v2 (npm) (malicious package) - [MAL-2026-3154](https://insights.sbomify.com/MAL-2026-3154/): Malicious code in apple-infra-gcp-leak (npm) (malicious package) - [MAL-2026-3153](https://insights.sbomify.com/MAL-2026-3153/): Malicious code in apple-infra-final-escape (npm) (malicious package) - [MAL-2026-3152](https://insights.sbomify.com/MAL-2026-3152/): Malicious code in apple-coredata-internal-service (npm) (malicious package) - [MAL-2026-3151](https://insights.sbomify.com/MAL-2026-3151/): Malicious code in apple-cloud-infrastructure-monitor (npm) (malicious package) - [MAL-2026-3150](https://insights.sbomify.com/MAL-2026-3150/): Malicious code in apple-cktool-api-v2 (npm) (malicious package) - [MAL-2026-315](https://insights.sbomify.com/MAL-2026-315/): Malicious code in tailwind-merge-v2 (npm) (malicious package) - [MAL-2026-3149](https://insights.sbomify.com/MAL-2026-3149/): Malicious code in agents-a365-runtime (npm) (malicious package) - [MAL-2026-3148](https://insights.sbomify.com/MAL-2026-3148/): Malicious code in amazon-boto (PyPI) (malicious package) - [MAL-2026-3147](https://insights.sbomify.com/MAL-2026-3147/): Malicious code in coinmate-typescript-client (npm) (malicious package) - [MAL-2026-3146](https://insights.sbomify.com/MAL-2026-3146/): Malicious code in timenow-py (PyPI) (malicious package) - [MAL-2026-3145](https://insights.sbomify.com/MAL-2026-3145/): Malicious code in timenow (PyPI) (malicious package) - [MAL-2026-3144](https://insights.sbomify.com/MAL-2026-3144/): Malicious code in timemcp190825790125120985125 (PyPI) (malicious package) - [MAL-2026-3143](https://insights.sbomify.com/MAL-2026-3143/): Malicious code in timemcp-utils (PyPI) (malicious package) - [MAL-2026-3142](https://insights.sbomify.com/MAL-2026-3142/): Malicious code in timemcp-client (PyPI) (malicious package) - [MAL-2026-3141](https://insights.sbomify.com/MAL-2026-3141/): Malicious code in coinmate-api (PyPI) (malicious package) - [MAL-2026-3140](https://insights.sbomify.com/MAL-2026-3140/): Malicious code in fivem-monitor (npm) (malicious package) - [MAL-2026-314](https://insights.sbomify.com/MAL-2026-314/): Malicious code in styled-system-old (npm) (malicious package) - [MAL-2026-3139](https://insights.sbomify.com/MAL-2026-3139/): Malicious code in robase-start (PyPI) (malicious package) - [MAL-2026-3138](https://insights.sbomify.com/MAL-2026-3138/): Malicious code in robase-apis (PyPI) (malicious package) - [MAL-2026-3137](https://insights.sbomify.com/MAL-2026-3137/): Malicious code in core-roblox-utils (PyPI) (malicious package) - [MAL-2026-3136](https://insights.sbomify.com/MAL-2026-3136/): Malicious code in timestamp-py (PyPI) (malicious package) - [MAL-2026-3135](https://insights.sbomify.com/MAL-2026-3135/): Malicious code in sf-th-requests (PyPI) (malicious package) - [MAL-2026-3134](https://insights.sbomify.com/MAL-2026-3134/): Malicious code in timemcp-py (PyPI) (malicious package) - [MAL-2026-3133](https://insights.sbomify.com/MAL-2026-3133/): Malicious code in fetchapi-syncdata-pypi (PyPI) (malicious package) - [MAL-2026-3132](https://insights.sbomify.com/MAL-2026-3132/): Malicious code in timemcp (PyPI) (malicious package) - [MAL-2026-3131](https://insights.sbomify.com/MAL-2026-3131/): Malicious code in kcvlib (PyPI) (malicious package) - [MAL-2026-3130](https://insights.sbomify.com/MAL-2026-3130/): Malicious code in genmedia-izumi-agent (PyPI) (malicious package) - [MAL-2026-313](https://insights.sbomify.com/MAL-2026-313/): Malicious code in spire.officejs-fonts (npm) (malicious package) - [MAL-2026-3129](https://insights.sbomify.com/MAL-2026-3129/): Malicious code in supertag (crates.io) (malicious package) - [MAL-2026-3128](https://insights.sbomify.com/MAL-2026-3128/): Malicious code in wm-plugin-teach-me-widget (npm) (malicious package) - [MAL-2026-3127](https://insights.sbomify.com/MAL-2026-3127/): Malicious code in coloreasyprint (PyPI) (malicious package) - [MAL-2026-3126](https://insights.sbomify.com/MAL-2026-3126/): Malicious code in lsh (crates.io) (malicious package) - [MAL-2026-3125](https://insights.sbomify.com/MAL-2026-3125/): Malicious code in transform-regexp-constructors (npm) (malicious package) - [MAL-2026-3124](https://insights.sbomify.com/MAL-2026-3124/): Malicious code in apple-internal-dev-check (npm) (malicious package) - [MAL-2026-3123](https://insights.sbomify.com/MAL-2026-3123/): Malicious code in apple-app-store-server-library-poc (npm) (malicious package) - [MAL-2026-3122](https://insights.sbomify.com/MAL-2026-3122/): Malicious code in @w3m-frame/session_update (npm) (malicious package) - [MAL-2026-3121](https://insights.sbomify.com/MAL-2026-3121/): Malicious code in @taxmoninor/taxmon (npm) (malicious package) - [MAL-2026-3120](https://insights.sbomify.com/MAL-2026-3120/): Malicious code in @pyme-web/web-api (npm) (malicious package) - [MAL-2026-312](https://insights.sbomify.com/MAL-2026-312/): Malicious code in spire.officejs-externs (npm) (malicious package) - [MAL-2026-3119](https://insights.sbomify.com/MAL-2026-3119/): Malicious code in @pyme-web/ui-widget (npm) (malicious package) - [MAL-2026-3118](https://insights.sbomify.com/MAL-2026-3118/): Malicious code in @pyme-web/ui-base (npm) (malicious package) - [MAL-2026-3117](https://insights.sbomify.com/MAL-2026-3117/): Malicious code in @business_promocode/cancel_promocode (npm) (malicious package) - [MAL-2026-3116](https://insights.sbomify.com/MAL-2026-3116/): Malicious code in @business_promocode/apply_promocode (npm) (malicious package) - [MAL-2026-3115](https://insights.sbomify.com/MAL-2026-3115/): Malicious code in @b2b_blocker/show_activation_error (npm) (malicious package) - [MAL-2026-3114](https://insights.sbomify.com/MAL-2026-3114/): Malicious code in @apple-pay-trust/finish (npm) (malicious package) - [MAL-2026-3113](https://insights.sbomify.com/MAL-2026-3113/): Malicious code in @apple-pay-trust/check-apple-pay-result (npm) (malicious package) - [MAL-2026-3112](https://insights.sbomify.com/MAL-2026-3112/): Malicious code in @apple-pay-trust/cancelled (npm) (malicious package) - [MAL-2026-3111](https://insights.sbomify.com/MAL-2026-3111/): Malicious code in @apple-pay-trust/authorize-payment (npm) (malicious package) - [MAL-2026-3110](https://insights.sbomify.com/MAL-2026-3110/): Malicious code in @apiary-annex/title (npm) (malicious package) - [MAL-2026-311](https://insights.sbomify.com/MAL-2026-311/): Malicious code in sparkling-router (npm) (malicious package) - [MAL-2026-3109](https://insights.sbomify.com/MAL-2026-3109/): Malicious code in @apiary-annex/meta (npm) (malicious package) - [MAL-2026-3108](https://insights.sbomify.com/MAL-2026-3108/): Malicious code in @activation_code/success (npm) (malicious package) - [MAL-2026-3107](https://insights.sbomify.com/MAL-2026-3107/): Malicious code in @activation_code/error (npm) (malicious package) - [MAL-2026-3106](https://insights.sbomify.com/MAL-2026-3106/): Malicious code in @activation_code/activate (npm) (malicious package) - [MAL-2026-3105](https://insights.sbomify.com/MAL-2026-3105/): Malicious code in mypypipkg (PyPI) (malicious package) - [MAL-2026-3104](https://insights.sbomify.com/MAL-2026-3104/): Malicious code in robase-ui (PyPI) (malicious package) - [MAL-2026-3103](https://insights.sbomify.com/MAL-2026-3103/): Malicious code in amzn_codewhisperer_streaming_client (crates.io) (malicious package) - [MAL-2026-3102](https://insights.sbomify.com/MAL-2026-3102/): Malicious code in semantic_search_client (crates.io) (malicious package) - [MAL-2026-3101](https://insights.sbomify.com/MAL-2026-3101/): Malicious code in amzn_consolas_client (crates.io) (malicious package) - [MAL-2026-3100](https://insights.sbomify.com/MAL-2026-3100/): Malicious code in fetch-data-api-syncapi (PyPI) (malicious package) - [MAL-2026-310](https://insights.sbomify.com/MAL-2026-310/): Malicious code in sky1oauth2 (npm) (malicious package) - [MAL-2026-31](https://insights.sbomify.com/MAL-2026-31/): Malicious code in telstra (PyPI) (malicious package) - [MAL-2026-3099](https://insights.sbomify.com/MAL-2026-3099/): Malicious code in bytedvod (PyPI) (malicious package) - [MAL-2026-3098](https://insights.sbomify.com/MAL-2026-3098/): Malicious code in bytedvke (PyPI) (malicious package) - [MAL-2026-3097](https://insights.sbomify.com/MAL-2026-3097/): Malicious code in bytedvefaas (PyPI) (malicious package) - [MAL-2026-3096](https://insights.sbomify.com/MAL-2026-3096/): Malicious code in bytedtccc (PyPI) (malicious package) - [MAL-2026-3095](https://insights.sbomify.com/MAL-2026-3095/): Malicious code in bytedpymysql (PyPI) (malicious package) - [MAL-2026-3094](https://insights.sbomify.com/MAL-2026-3094/): Malicious code in bytedpgsql (PyPI) (malicious package) - [MAL-2026-3093](https://insights.sbomify.com/MAL-2026-3093/): Malicious code in bytedmlp (PyPI) (malicious package) - [MAL-2026-3092](https://insights.sbomify.com/MAL-2026-3092/): Malicious code in bytedmem (PyPI) (malicious package) - [MAL-2026-3091](https://insights.sbomify.com/MAL-2026-3091/): Malicious code in bytedfaas (PyPI) (malicious package) - [MAL-2026-3090](https://insights.sbomify.com/MAL-2026-3090/): Malicious code in bytedecs (PyPI) (malicious package) - [MAL-2026-309](https://insights.sbomify.com/MAL-2026-309/): Malicious code in sd-pdc-module-client (npm) (malicious package) - [MAL-2026-3089](https://insights.sbomify.com/MAL-2026-3089/): Malicious code in bytedclaw (PyPI) (malicious package) - [MAL-2026-3088](https://insights.sbomify.com/MAL-2026-3088/): Malicious code in bytedbackground (PyPI) (malicious package) - [MAL-2026-3087](https://insights.sbomify.com/MAL-2026-3087/): Malicious code in bytedark (PyPI) (malicious package) - [MAL-2026-3086](https://insights.sbomify.com/MAL-2026-3086/): Malicious code in bytedai (PyPI) (malicious package) - [MAL-2026-3085](https://insights.sbomify.com/MAL-2026-3085/): Malicious code in bytedaaa (PyPI) (malicious package) - [MAL-2026-3084](https://insights.sbomify.com/MAL-2026-3084/): Malicious code in byteclaw (PyPI) (malicious package) - [MAL-2026-3083](https://insights.sbomify.com/MAL-2026-3083/): Malicious code in elementary-data (PyPI) (malicious package) - [MAL-2026-3082](https://insights.sbomify.com/MAL-2026-3082/): Malicious code in kl-b2c-ui-kit (npm) (malicious package) - [MAL-2026-3081](https://insights.sbomify.com/MAL-2026-3081/): Malicious code in frank-research-poc-apple (npm) (malicious package) - [MAL-2026-3080](https://insights.sbomify.com/MAL-2026-3080/): Malicious code in frank-bot-gogle-cloning (npm) (malicious package) - [MAL-2026-308](https://insights.sbomify.com/MAL-2026-308/): Malicious code in sd-navbar-module-client (npm) (malicious package) - [MAL-2026-3079](https://insights.sbomify.com/MAL-2026-3079/): Malicious code in axis-ui-generator (npm) (malicious package) - [MAL-2026-3078](https://insights.sbomify.com/MAL-2026-3078/): Malicious code in axis-notification (npm) (malicious package) - [MAL-2026-3077](https://insights.sbomify.com/MAL-2026-3077/): Malicious code in axis-charts (npm) (malicious package) - [MAL-2026-3076](https://insights.sbomify.com/MAL-2026-3076/): Malicious code in axis-abc-search-address (npm) (malicious package) - [MAL-2026-3075](https://insights.sbomify.com/MAL-2026-3075/): Malicious code in axis-abc-search-account (npm) (malicious package) - [MAL-2026-3074](https://insights.sbomify.com/MAL-2026-3074/): Malicious code in axis-abc-portal-menu (npm) (malicious package) - [MAL-2026-3073](https://insights.sbomify.com/MAL-2026-3073/): Malicious code in @tw-utils/static (npm) (malicious package) - [MAL-2026-3072](https://insights.sbomify.com/MAL-2026-3072/): Malicious code in @tw-models/storage (npm) (malicious package) - [MAL-2026-3071](https://insights.sbomify.com/MAL-2026-3071/): Malicious code in @tw-marionette/input (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/84/